# Issue changing value of JSON field in logstash

**URL:** https://discuss.elastic.co/t/issue-changing-value-of-json-field-in-logstash/52309
**Category:** Logstash
**Created:** [June 9, 2016, 9:36am UTC](https://discuss.elastic.co/t/issue-changing-value-of-json-field-in-logstash/52309 "2016-06-09T09:36:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Mick\_Mahoney](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)
#### Post date: [June 9, 2016, 9:36am UTC](https://discuss.elastic.co/t/issue-changing-value-of-json-field-in-logstash/52309/1 "2016-06-09T09:36:11Z")

</div>

Hi,

I'm trying to change a value in logstash of JSON which has been generated by Topbeat

Below are the input file name, the logstash filter, and the error that I am getting

Can anyone spot why I'm getting the error please ?

Very Much appreciated,  
Mick

# JSON input file

{  
"\_index": "logstashsystem-2016.06.08",  
"\_type": "system",  
"\_id": "AVUxwZ29nE6fvOfjobS-",  
"\_score": null,  
"\_source": {  
"@timestamp": "2016-06-08T20:43:39.209Z",  
"beat": {  
"hostname": "serverName",  
"name": "serverName"  
},  
"cpu": {  
"idle": 359180971,  
"iowait": 211944,  
"irq": 91,  
"nice": 54369,  
"softirq": 33274,  
"steal": 0,  
"system": 2280639,  
"system\_p": 0.0045,  
"user": 4354223,  
"user\_p": 0.011  
},  
"sort": [  
1465418619209  
]  
}

# Logstash Filter

filter{  
ruby {  
code =\> "event['\_source']['cpu']['system\_p'] = event['\_source']['cpu']['system\_p'].to\_f \* 100"  
}  
}

# Error

{:timestamp=\>"2016-06-09T09:29:08.352000+0000", :message=\>"Ruby exception occurred: undefined method `[]' for nil:NilClass", :level=\>:error}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 10, 2016, 5:50am UTC](https://discuss.elastic.co/t/issue-changing-value-of-json-field-in-logstash/52309/2 "2016-06-10T05:50:15Z")

</div>

What do the events that Logstash is processing look like? Please show the output of a `stdout { codec => rubydebug }` filter.

---

<div class="post-metadata">

### Author: ![Mick\_Mahoney](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)
#### Post date: [June 10, 2016, 7:33am UTC](https://discuss.elastic.co/t/issue-changing-value-of-json-field-in-logstash/52309/3 "2016-06-10T07:33:46Z")

</div>

Magnus,

When I set up the stdout and ran it was obvious that the \_source should not have been used in my event.

So what worked was:  
ruby {code =\> "event['cpu']['system\_p'] = event['cpu']['system\_p'].to\_f \* 100"}

Many thanks for helping me to get there 🙂

Thanks,

Mick

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/issue-changing-value-of-json-field-in-logstash/52309/4 "2017-07-06T04:53:44Z")

</div>